Buggy code:
public class SimpleMapper1 extends BaseInterceptor { ContextManager cm ; PrefixMapper map ; int ctExtMapNote = - 1 ; int defaultMapNOTE = - 1 ; boolean mapCacheEnabled = false ; public SimpleMapper1 ( ) { } public void setMapCache ( boolean v ) { } public void engineInit ( ContextManager cm ) throws TomcatException { } public void addContext ( ContextManager cm , Context ctx ) throws TomcatException { } public void removeContext ( ContextManager cm , Context ctx ) throws TomcatException { } public void addContainer ( Container ct ) throws TomcatException { } public void removeContainer ( Container ct ) throws TomcatException { } public int contextMap ( Request req ) { String path = req . getRequestURI ( ) ; if ( path == null ) throw new RuntimeException ( "ASSERT:<seq2seq4repair_space>null<seq2seq4repair_space>path<seq2seq4repair_space>in<seq2seq4repair_space>request<seq2seq4repair_space>URI" ) ; if ( ( path . indexOf ( "?" ) ) >= 0 ) throw new RuntimeException ( "ASSERT:<seq2seq4repair_space>?<seq2seq4repair_space>in<seq2seq4repair_space>requestURI" ) ; <START_BUG> if ( ( ( path . indexOf ( '%' ) ) >= 0 ) || ( ( path . indexOf ( '+' ) ) >= 0 ) ) { <END_BUG> path = RequestUtil . URLDecode ( path ) ; } try { String host = null ; host = req . getServerName ( ) ; if ( ( debug ) > 0 ) cm . log ( ( "Host<seq2seq4repair_space>=<seq2seq4repair_space>" + host ) ) ; Container container = ( ( Container ) ( map . getLongestPrefixMatch ( host , path ) ) ) ; if ( container == null ) throw new RuntimeException ( ( "Assertion<seq2seq4repair_space>failed:<seq2seq4repair_space>" + "container==null" ) ) ; if ( ( debug ) > 0 ) cm . log ( ( ( ( ( ( ( ( "SM:<seq2seq4repair_space>Prefix<seq2seq4repair_space>match<seq2seq4repair_space>" + path ) + "<seq2seq4repair_space>-><seq2seq4repair_space>" ) + ( container . getPath ( ) ) ) + "<seq2seq4repair_space>" ) + ( container . getHandler ( ) ) ) + "<seq2seq4repair_space>" ) + ( container . getRoles ( ) ) ) ) ; fixRequestPaths ( path , req , container ) ; if ( ( container . getHandler ( ) ) == null ) { Container extC = matchExtension ( req ) ; if ( extC != null ) { if ( ( extC . getHandler ( ) ) != null ) { fixRequestPaths ( path , req , extC ) ; container = extC ; } if ( ( debug ) > 0 ) log ( ( "SM:<seq2seq4repair_space>Found<seq2seq4repair_space>extension<seq2seq4repair_space>mapping<seq2seq4repair_space>" + ( extC . getHandler ( ) ) ) ) ; } } if ( ( container . getHandler ( ) ) == null ) { Container ctxDef = req . getContext ( ) . getContainer ( ) ; Container defC = ( ( Container ) ( ctxDef . getNote ( defaultMapNOTE ) ) ) ; if ( ( defC != null ) && ( ( defC . getHandler ( ) ) != null ) ) { fixRequestPaths ( path , req , defC ) ; if ( ( debug ) > 0 ) log ( ( ( ( ( ( "SM:<seq2seq4repair_space>Found<seq2seq4repair_space>default<seq2seq4repair_space>mapping<seq2seq4repair_space>" + ( defC . getHandler ( ) ) ) + "<seq2seq4repair_space>" ) + ( defC . getPath ( ) ) ) + "<seq2seq4repair_space>" ) + ( defC . getMapType ( ) ) ) ) ; } } if ( ( debug ) > 0 ) log ( ( ( ( "SM:<seq2seq4repair_space>After<seq2seq4repair_space>mapping<seq2seq4repair_space>" + req ) + "<seq2seq4repair_space>" ) + ( req . getWrapper ( ) ) ) ) ; } catch ( Exception ex ) { log ( ( "Mapping<seq2seq4repair_space>" + req ) , ex ) ; return 500 ; } return OK ; } public int requestMap ( Request req ) { } Container matchExtension ( Request req ) { } void fixRequestPaths ( String path , Request req , Container container ) throws Exception { } }

Fix:
if ( ( path . indexOf ( '%' ) ) >= 0 ) {